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The MAILING DATE of this communication appears on the cover sheet with the correspondence address 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )K Responsive to communication(s) filed on 20 November 2002 . 
2a)D This action is FINAL. 2b)^ This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 
Disposition of Claims 

4) ^3 Claim(s) 1-13 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) ^ Claim(s) 1-13 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

11) D The proposed drawing correction filed on is: a)D approved b)D disapproved by the Examiner. 

If approved, corrected drawings are required in reply to this Office action. 

12) D The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§119 and 120 

13) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 

a)DAII b)D Some*c)D None of: 

1 0 Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

14) E3 Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 1 19(e) (to a provisional application). 

a) □ The translation of the foreign language provisional application has been received. 

15) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121 . 
Attachment(s) 

1 ) ^ Notice of References Cited (PTO-892) 4) Q Interview Summary (PTO-41 3) Paper No(s). . 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) 5) D Notice of Informal Patent Application (PTO-152) 

3) Information Disclosure Statement(s) (PTO-1449) Paper No(s) 5& 8 . 6) □ Other: 
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DETAILED ACTION 



1 . Claims 1 -1 3 are presented for examination. 



2. The abstract of the disclosure is objected to because it is too long. 

Applicant is reminded of the proper language and format for an abstract of the 
disclosure. 

The abstract should be in narrative form and generally limited to a single 
paragraph on a separate sheet within the range of 50 to 1 50 words. It is important that 
the abstract not exceed 150 words in length since the space provided for the abstract 
on the computer tape used by the printer is limited. The form and legal phraseology 
often used in patent claims, such as "means" and "said," should be avoided. The 
abstract should describe the disclosure sufficiently to assist readers in deciding whether 
there is a need for consulting the full patent text for details. 

The language should be clear and concise and should not repeat information 
given in the title. It should avoid using phrases which can be implied, such as, "The 
disclosure concerns," "The disclosure defined by this invention," "The disclosure 
describes," etc. 

Correction is required. See MPEP § 608.01(b). 



3. The cross references related to the application cited in the specification must be 
updated [i.e., update the relevant status with PTO serial number or patent number 
where appropriate, on page 2, lines 8-9]. Correction is required. 



4. Claims 1-9 are rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 
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A. The following terms lack proper antecedent basis: 

i. As per claim 1, line 5, "the second analyzer." 

B. The claim language in the following claims is not clearly understood. 

i. As per claim 1, lines 3, it is unclear the definition of "session 
reconstruction analysis "[i.e., it refers to analyzing the session or reconstruct the 
session]; lines 1-9, it is uncertain the relation between first analyzer, second 
analyzer and third analyzer [i.e., are they the same type analyzers or different 
type analyzers] 

Correction is required. 



Claim Rejections - 35 USC § 103 
5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 



6. Claims 1 and 10 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Gleichauf et al. (6,499,107 B1). 
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7. As per claims 1 and 10, Gleichauf teaches the invention substantially as claimed 
including a method of reconstructing a session using a first analyzer [4, Fig. 1] coupled 
to a second analyzer [5, Fig. 1] and a data collector [36, Fig. 2] the method comprising: 

performing session reconstruction analysis on packets received at the first 
analyzer [100, 104, Fig. 4; col. 4, lines 4-7]; 

responsive to successful session reconstruction on the first analyzer, 
sending a first message to at least one of the second analyzer and the data collector, 
the first message corresponding to session data [col. 8, lines 18-30]; and 

the second analyzer also receiving one or more messages from a third analyzer 
[col. 8, lines 25-30; i.e., there are more than one protocol analyzer in the system]. 

8. Gleichauf does not specifically teach the step of sending one or more messages 
to the second analyzer responsive to unsuccessful session reconstruction on the first 
analyzer. It would have been obvious to a person of ordinary skill in the art at the time 
the invention was made to send message to the second analyzer because doing so 
would increase the efficiency of the system by avoiding analyzing the data packet 
further if it could not pass the first analyzer. One of ordinary skill in the art would have 
been motivated to modify the system to improve the performance. 

9. Claims 1-13 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
McCreery et al. (US 5,787,253). 
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10. As per claim 1 , McCreery teaches the invention substantially as claimed 
including a method of reconstructing a session using a first analyzer [336, Fig. 4c] 
coupled to a second analyzer [346, Fig. 4c] and a data collector [342, Fig. 4c] the 
method comprising: 

performing session reconstruction analysis on packets received at the first 
analyzer [col. 2, lines 20-22]; 

responsive to successful session reconstruction on the first analyzer, 
sending a first message to at least one of the second analyzer and the data collector, 
the first message corresponding to session data [col. 2, lines 22-24 & 34-39]; and 

1 1 . McCreery does not specifically teach that the second analyzer receives the 
messages from a third analyzer. It would have been obvious to a person of ordinary skill 
in the art at the time the invention was made that including a third analyzer in 
McCreerys system for analyzing the data stream from multiple sources because doing 
so would increase the speed of the system. 

12. McCreery does not specifically teach the step of sending one or more messages 
to the second analyzer responsive to unsuccessful session reconstruction on the first 
analyzer. It would have been obvious to a person of ordinary skill in the art at the time 
the invention was made to include sending message to the second analyzer in 
Abromavage's system because doing so would increase the efficiency of the system by 
avoiding analyzing the data packet further if it could not pass the first analyzer. One of 
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ordinary skill in the art would have been motivated to modify the system to improve the 
performance. 

1 3. As per claim 2, McCreery teaches that the one or more messages from the first 
analyzer to the second analyzer comprise packets received by the first analyzer [col. 2, 
lines 20-36]. 

14. As per claims 3 and 4, McCreery teaches that the one or more messages from 
the first analyzer to the second analyzer further comprise a time the packet was 
received and an address information for the packet [col. 2, lines 22-24]. 

15. As per claim 5, McCreery teaches the step of filtering the packets before them 
reach the first analyzer [col. 2, lines 16-20]. 

16. As per claim 6, since it does not introduce further limitation from claim 1 , it is 
rejected for the same basis as claim 1 above. 

1 7. As per claims 7-9, McCreery teaches that the second analyzer performing the 
session reconstruction based on the messages received from first analyzer and sending 
a second message to the data collector [col. 2, lines 34-39]. 
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18. As per claims 10-13, since they are system claims of claims 1-9, they are 
rejected for the same basis as claims 1-9 above. 

19. Claim 1-13 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Abromavage et al. (WO 00/6881 1 ). 

20. Abromavage is a prior art reference cited by Applicant, filed on 6/25/01 . 

21 . As per claim 1 , Abromavage teaches the invention substantially as claimed 
including a method of reconstructing a session using a first analyzer coupled to a 
second analyzer [112, 120, Fig. 1] and a data collector [122, Fig. 1] the method 
comprising: 

performing session reconstruction analysis on packets received at the first 
analyzer [col. 5, lines 14-19; col. 6, lines 3-10]; 

responsive to successful session reconstruction on the first analyzer, sending a 
first message to at least one of the second analyzer and the data collector, the first 
message corresponding to session data [col. 6, lines 14-22]; and 

22. Abromavage does not specifically teach that the second analyzer receives the 
messages from a third analyzer. It would have been obvious to a person of ordinary skill 
in the art at the time the invention was made that including a third analyzer in 
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Abromavage's system for analyzing the data stream from multiple sources because 
doing so would increase the speed of the system. 

23. Abromavage does not teach the step of sending one or more messages to the 
second analyzer responsive to unsuccessful session reconstruction on the first 
analyzer. It would have been obvious to a person of ordinary skill in the art at the time 
the invention was made to include sending message to the second analyzer in 
Abromavage's system because doing so would increase the efficiency of the system by 
avoiding analyzing the data packet further if it could not pass the first analyzer. One of 
ordinary skill in the art would have been motivated to modify the system to improve the 
performance. 

24. As per claim 2, Abromavage teaches that the one or more messages from the 
first analyzer to the second analyzer comprise packets received by the first analyzer 
[col. 6, lines 14-15]. 

25. As per claims 3 and 4, Abromavage teaches that the one or more messages 
from the first analyzer to the second analyzer further comprise a time the packet was 
received and an address information for the packet [col. 5, lines 14-19; col. 6, lines 14- 
15 & 23-27]. 
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26. As per claim 6, since it does not introduce further limitation from claim 1 , it is 
rejected for the same basis as claim 1 above. 

27. As per claims 7-9, Abromavage teaches that the second analyzer performing the 
session reconstruction based on the messages received from first analyzer and sending 
a second message to the data collector [col. 6, lines 16-27; col. 10, lines 3-7]. 

28. As per claims 10-13, since they are system claims of claims 1-9, they are 
rejected for the same basis as claims 1-9 above. 

29. Claim 5 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Abromavage et al. (WO 00/6881 1) in view of McCreery et al. (US 5,787,253). 

30. As per claim 5, Abromavage teaches the invention substantially as claimed in 
claim 1 . Abromavage does not specifically teach that the packets received at the first 
analyzer are output from a filter for controlling which packets in a plurality of packets 
flowing into the filter reach the first analyzer. 

31. However, McCreery on the other hand teaches the step of filtering the packets 
before them reach the first analyzer [col. 2, lines 16-20]. It would have been obvious to 
a person of ordinary skill in the art at the time the invention was made to filter the 
packets before analyzing the packets because doing so would relief the burden of the 
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system by avoiding analyzing undesired packets. One of ordinary skill in the art would 
have been motivated to modify Abromavage's system with McCreerys filter to increase 
the efficiency of the system. 



32. The prior art made of record and not relied upon is considered pertinent to 
applicants disclosure: 

Chiu et al. (US 5,101 ,402) discloses a network monitoring system; 
Abramson et al. (US 6,539,494) discloses a session back up system; 
Aziz et al. (US 6,018,721) discloses a collateral monitoring system; and 
Braddy (US 6,141,759) disclose a network monitoring system. 

33. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jinsong Hu whose telephone number is (703) 306- 



If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Meng-Ai An, can be reached on (703) 305-9678. The fax number for this 
Group is (703) 308-9052. Additionally, the fax numbers for Group 2100 are as follow: 



Conclusion 



5932. 



Official Faxes: 



(703) 746-7239 



After Final Responses: 



(703) 746-7238 



Draft Responses: 



(703) 746-7240 
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Any inquiry of a general nature or relating to the status of the application should 
be directed to the Group receptionist at (703) 305-3900. 



Jinsong Hu 
April 30, 2003 



MENG-ALT. AN 
SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTER 2100 



